AT&T's Bid to Dismiss $1.8M Crypto Theft Lawsuit Has Been Rejected

Key highlights:

Investor Seth Shapiro was a victim of SIM-swap attacks in 2019 and lost $1.8 million worth of digital assets

AT&T’s bid to dismiss a lawsuit, in which Shapiro accused AT&T of negligence, has been recently rejected

Pioneering crypto investor Michael Terpin is also suing AT&T for similar allegations

Terpin also filed a lawsuit against the perpetrator of the attack, who turned out to be just 15 years old when he committed the crime

U.S. District Judge Consuelo Marshall has rejected AT&T’s bid to dismiss a lawsuit, in which plaintiff Seth Shapiro accuses AT&T of negligence that resulted in the theft of $1.8 million in crypto. By rejecting AT&T’s bid to dismiss, the judge is allowing the suit to continue. All the claims brought under the Computer Fraud and Abuse Act, and request for punitive damages, were left intact. Shapiro has until May 29th to file an amended complaint in response to the order.

SIM-swap attacks were allegedly possible due to AT&T’s negligence

Emmy Award-winning media tech consultant Seth Shapiro, who has previously worked for Disney and Showtime, filed the lawsuit against AT&T back in December 2019 after losing $1.8 million worth of crypto in a SIM-swap attack. He proceeded to file a lawsuit, accusing the largest U.S. telecom company of negligence and alleging that the firm’s security failures resulted in thefts across multiple attacks. Shapiro’s complaint states:

"AT&T failed to implement sufficient data security systems and procedures and failed to supervise its own personnel, instead of standing by as its employees used their position at the company to gain unauthorized access to Mr. Shapiro's account in order to rob, extort and threaten him in exchange for money."

How do SIM-swap attacks take place?

A telecom company employee deliberately or unintentionally reassigns the victim’s phone number to a SIM card (hence the name SIM-swap attack) controlled by an attacker. By doing this, the attacker gains access to information and accounts belonging to the target, along with 2FA credentials.

Shapiro suffered his first SIM-swap attack in May 2018. He was later reassured by an AT&T employee that “his SIM card would not be swapped again without his authorization”, but became a victim of the second attack soon after that.

Michael Terpin is seeking over $200 million in a similar lawsuit against AT&T

AT&T is already battling a similar lawsuit from pioneering crypto investor Michael Terpin. Terpin, who was also a victim of two consecutive SIM-swap attacks, is seeking more than $200 million in compensation for the theft of $23.8 million worth of crypto in January 2018.

Ellis Pinsky, the alleged perpetrator of the SIM swap attack on Terpin, was just 15 years old when he allegedly committed the crime. However, Pinsky recently turned 18 and Terpin has filed a lawsuit against him.

Reportedly, Pinsky already returned $2 million of the stolen funds soon after the attack. The prominent crypto investor is now suing Pinsky for the remaining sum plus damages, totaling $71.4 million.

“I was a bit shocked to find out the alleged mastermind was only 15 at the time… Allegedly, this was not his first hacking or theft,” Terpin commented on the age of the hacker.

Terpin also asserted that Pinsky is still in possession of $100 million, stating:

“We believe he was being truthful when he told one of our informants via text that he still had $100 million hidden offshore.”

We will keep you updated on how the SIM-swap attack related lawsuits unfold.